Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How can I secure the channel of communication between cross account event bridges?

0

Hi, I am setting up cross account event bridges and want the messages to be transmitted securely and not via public network. I understand I can create VPC endpoints on event bridge but those can be used only from the resources within the VPC (same account). I want to create a secure channel between the two event bridges that are hosted on different accounts. Or does the traffic between two eventbridges (essentially AWS services) ever go over public network?

Thanks

Topics
Application IntegrationServerlessNetworking & Content DeliveryAWS Well-Architected Framework
Tags
Amazon VPCAmazon EventBridgeSecurity
Language
English
asked 3 years ago570 views
3 Answers
2

EventBridge is managed in the EveentBridge service VPC. No customer has access to that VPC. When you have a rule targeting an event bus, regardless in the same account or a different account, it stays within the EventBridge service. It does not go to the internet, it is not accessible by anyone.

AWS
EXPERT
answered 3 years ago
  • rePost-User-1191271
    3 years ago

    thanks Uri. Is this documented anywhere? I would need an AWS artefact confirming this.

1

To answer the last part of the question: Traffic between AWS services does not go across the public internet as per the VPC FAQ.

AWS
EXPERT
answered 3 years ago
  • rePost-User-1191271
    3 years ago

    I understand the traffic flows within AWS infrastructure only, but other tenants can still have access to this data, and hence I am looking for a private channel that can be accessed only by the 2 accounts involved in the cross-account integration.

  • Brettski-AWS EXPERT
    3 years ago

    Could you explain why you think that other tenants have access to the data? That's not true unless you have explicitly given a foreign account (i.e. one not controlled by you) access to the EventBridge.

1

Hi, use EventBridge ad hoc rules to go cross-account: see https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html

Then, Event Bridge encrypts its messages; https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-data-protection.html

EXPERT
answered 3 years ago
  • rePost-User-1191271
    3 years ago

    I understand the messages will be encrypted using TLS, but I prefer something more secure like MASSL or a private vpc channel.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content